CVE-2018-10905

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-78

Affected software

Vendor	Product	Versions
[UNKNOWN]	cfme	n/a

References

https://access.redhat.com/errata/RHSA-2018:2561Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2745Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10905Issue Tracking, Mitigation, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2561Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2745Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10905Issue Tracking, Mitigation, Vendor Advisory

Timeline

Published: Jul 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-109067.8In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non CVE-2018-109078.8It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating f CVE-2018-109086.3It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially craf CVE-2018-10915.5In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be trigge CVE-2018-109103.3A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This si CVE-2018-109117.5A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this fla CVE-2018-109124.9keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mi CVE-2018-109136.5An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to de CVE-2018-109146.5It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a CVE-2018-109157.5A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between co CVE-2018-109166.5It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integr CVE-2018-109176.5pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to l